GCVE - cpe:2.3:a:nopcommerce:nopcommerce:4.50.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:nopcommerce:nopcommerce:4.50.1:*:*:*:*:*:*:*

part: a version: 4.50.1 update: *

Vendor	Nopcommerce (`31f49e67-f1f3-583d-8ab1-a0a72890a9ba`)
Product	Nopcommerce (`8ae8e9ea-9c0a-5411-b1c1-434095635802`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/nopcommerceteam/nopcommerce`	purl2cpe	2026-06-01 10:17:57.976673
`pkg:github/nopsolutions/nopcommerce`	purl2cpe	2026-06-01 10:17:57.976675
`pkg:nuget/NopCommerce.Core`	purl2cpe	2026-06-01 10:17:57.976676
`pkg:sourceforge/nopcommerce.mirror`	purl2cpe	2026-06-01 10:17:57.976677

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-28451`	vulnerable	2026-06-08 05:42:44.527311	Details available nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature. Published: 2022-05-01T23:12:44.000Z Updated: 2024-08-03T05:56:15.415Z Open on db.gcve.eu Reference links https://github.com/nopSolutions/nopCommerce/commit/47ff9a241243db9359f10216bcf401baaa36d0b4 https://github.com/nopSolutions/nopCommerce/issues/6203	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-28450`	vulnerable	2026-06-08 05:42:44.526915	Details available nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a remote attacker to execute arbitrary JavaScript code at client browser. Published: 2022-04-26T20:05:46.000Z Updated: 2024-08-03T05:56:15.079Z Open on db.gcve.eu Reference links https://github.com/nopSolutions/nopCommerce/issues/6194	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-28449`	vulnerable	2026-06-08 05:42:44.526619	Details available nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account feature, an attacker can upload an arbitrary file to the system. Published: 2022-04-26T20:02:42.000Z Updated: 2024-08-03T05:56:15.499Z Open on db.gcve.eu Reference links https://github.com/nopSolutions/nopCommerce/issues/6192	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-28448`	vulnerable	2026-06-08 05:42:44.526232	Details available nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can inject javascript code to First name or Last name at Customer Info. Published: 2022-04-26T19:58:32.000Z Updated: 2024-08-03T05:56:15.455Z Open on db.gcve.eu Reference links https://github.com/nopSolutions/nopCommerce/issues/6191	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.